tinba | 7cf562e64c088d1c6972b31738c1e0ce59353190b8820c691186dcc14b1cfb5b | Triage

Sharing

General

Target

7cf562e64c088d1c6972b31738c1e0ce59353190b8820c691186dcc14b1cfb5b.exe
Size

225KB
Sample

250205-ltsfra1mbw
MD5

4acf8717885593e4930aa37a4b4ce635
SHA1

b6ecadbcb0abeb64bc550a52e3c3ff4460e59b51
SHA256

7cf562e64c088d1c6972b31738c1e0ce59353190b8820c691186dcc14b1cfb5b
SHA512

8c91981deb76838fd878b4b6409c595452a18d7120b4bf757d1ea8f7c93ea0d6777525c8851f360389733edf2c0a613d007918e9367f663efd8a9d044a27b00c
SSDEEP

6144:gA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:gATuTAnKGwUAW3ycQqgt

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  7cf562e64c088d1c6972b31738c1e0ce59353190b8820c691186dcc14b1cfb5b.exe
- Size
  
  225KB
- MD5
  
  4acf8717885593e4930aa37a4b4ce635
- SHA1
  
  b6ecadbcb0abeb64bc550a52e3c3ff4460e59b51
- SHA256
  
  7cf562e64c088d1c6972b31738c1e0ce59353190b8820c691186dcc14b1cfb5b
- SHA512
  
  8c91981deb76838fd878b4b6409c595452a18d7120b4bf757d1ea8f7c93ea0d6777525c8851f360389733edf2c0a613d007918e9367f663efd8a9d044a27b00c
- SSDEEP
  
  6144:gA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:gATuTAnKGwUAW3ycQqgt
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2